EUVD-2026-75595
GHSA-8qv3-jfg8-cjvp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N/UI:N) but the crafted URL must be ingested by CSF's monitoring (the 4.0 AT:P requirement) so AC:H; RCE as a root-level service account yields C/I/A:H.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection.
The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
AnalysisAI
Remote code execution in ConfigServer Security & Firewall (CSF) allows an unauthenticated attacker to run arbitrary OS commands as the CSF service account through shell command injection stemming from improperly escaped request URLs. It affects the original ConfigServer distribution and the WebPros-maintained fork containing the vulnerable code, and is fixed in WebPros version 16.30. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an attacker-supplied request URL reach CSF's URL-handling/escaping code path - the CVSS AT:P flag indicates a specific attack requirement, most plausibly that the malicious URL is observed and processed by CSF's log/request monitoring rather than exploited via an arbitrary standalone request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N): network-reachable, unauthenticated, no user interaction, with high confidentiality/integrity/availability impact to the vulnerable system and minor subsequent-system impact - consistent with code execution as a privileged service account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to WebPros ConfigServer Security & Firewall version 16.30 or later, per the cPanel/WebPros advisory (https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running ConfigServer Security & Firewall and determine whether each runs the original distribution or WebPros fork; immediately apply network-level access restrictions to CSF components and review recent logs for suspicious requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today